<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-fareast-language:EN-CA;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I don’t know myself whether there are any users with disabilities that would preclude the use of TOTP; my guess is there aren’t, whether because those people don’t exist or whether TOTP isn’t a problem
– dunno.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I meant only exactly what I said, that I hope someone has put more than a few seconds’ thought about that into this. Legal ramifications COULD occur, albeit with low likelihood.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">The main reason to allow SMS 2FA, despite its known weaknesses, is simply that the entire world is very much not ready for FIDO/TOTP yet. As Chris said, requiring only FIDO/TOTP is an excellent
way to alienate people, especially the US and Canada, where non-SMS-based 2FA is still uncommon. I have precisely one system that requires non-SMS, non-email 2FA, and that was forced upon my org by external requirements. I really do not want to add more.
Even the email-based 2FA systems have a high chance of causing a catch-22 situation.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">IMO, the least-bad 2FA system is one that lets me authenticate via whatever system I can right at the moment. If my AS has been hijacked, will I be able to receive email? SMS would probably still
work, as would TOTP. If my phone is broken, what options do I have for logging in?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">A perfectly secure system is a perfectly unusable system. The balance between security and usability has been axiomatic in computing since before I was born. It’s not really up for debate right
now.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I DO NOT WANT SECURITY that presents any significant chance of denying me access to my own accounts and resources. SMS or email-based 2FA schemes are a giant PITA, but both are fairly easily recoverable
when (not if) I lose access to them. Are they good 2FA? No. Absolutely not. Are they better than nothing? Yes.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">This entire discussion feels like
</span><a href="https://xkcd.com/538/">https://xkcd.com/538/</a> to me. If someone wants access to my ARIN resources, one of the easier ways in would be to physically threaten me or my family, and the best 2FA implementations in the world do nothing (AFAIK)
to protect against that. The specific technique or technology involved won’t make any difference.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">The people who insist that SMS shouldn’t be allowed, that email shouldn’t be allowed, that there should be a maximum of 3 TOTPs or keys registered – you are alienating me, a user of ARIN resources.
You are driving me away from the community. And when the pain of logging in to ARIN exceeds the pain of not having up-to-date SWIPs or contact info, guess what’ll happen? The database is already riddled with garbage/obsolete information, adding more security
is going to make that situation worse, not better.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">The goal should be to add the minimum increment of security that satisfies the business objective. Unfortunately, the business objective here seems to have been “add 2FA” which is a technical objective,
not a business objective.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Someone with the technical skills of your grandmother is probably the ARIN contact of record for some resource or other – and it’s likely a job they inherited and have no idea what to do with. Can
you imagine getting your grandparents to deal with 2FA?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Unhappy about the whole process from start to finish, as it’s very clearly (to me) the tail wagging the dog. A solution in search of a problem, if you prefer that wording. Just enforcing password
length > 20 would have increased security without needing 2FA. (Obviously not increased *<b>enough</b>* to satisfy everyone, but my statement stands.)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">BTW: having been the technical architect for a cellular telephone company in Canada, yes, I know exactly how easy it is and isn’t to divert SMS at the network/carrier level. It’s a non-zero risk,
but it’s *<b>still better than nothing</b>*.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">-Adam<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Ross Tajvar <ross@tajvar.io>
<br>
<b>Sent:</b> Tuesday, January 24, 2023 2:51 PM<br>
<b>To:</b> Adam Thompson <athompso@athompso.net><br>
<b>Cc:</b> Richard Laager <rlaager@wiktel.com>; arin-consult@arin.net<br>
<b>Subject:</b> Re: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On the topic of hypothetical compromise - my ARIN account hasn't been compromised, but other accounts protected with SMS 2FA have been. I have had money stolen via that vector. So it's a real concern for me. Maybe
<i>my</i> ARIN account isn't valuable enough to hack, but my employer's is.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I don't think we should disregard real attack vectors that definitely do happen in the real world just because they're uncommon and the mitigations are inconvenient to some people. I also acknowledge the importance of disability accommodation; however,
I doubt that disallowing email (or SMS) 2FA would be an issue there (though I welcome a correction if I'm wrong).<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jan 24, 2023 at 3:36 PM Adam Thompson <<a href="mailto:athompso@athompso.net">athompso@athompso.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">Since I have a nearly magical ability to damage every authentication device I've ever been issued (including my phone - this one has lasted over a year, which I think is av record), I'm highly doubtful of any scheme that *assumes* any authenticator
is durable. I would like a *minimum* of 3 active - one in my pocket, one in a locked drawer at work, one in a secure spot at home or in my car or somewhere else.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Double + 1 that number to account for rollover, and I'll already want to have up to 7 registered at times, for any account that's super-critical.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121">Yes, that's about how many copies of physical keys for locks that I like to get made, because I lose those, too.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121">Could I live with a limit of 10? Yeah, probably.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121">Which is more important: keeping bad actors out, or letting authorized users in?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121">All I'm hearing during this discussion is protecting accounts against hypothetical compromise (with IIRC no evidence this has ever happened, or any negative outcome has occurred previously)
with no consideration of people who have unusual needs.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121">(Some of those needs, definitely not all, are referred to in American law as "disabilities", btw. I hope someone at ARIN has thought about how the proposed 2FA scheme complies with the
ADA?)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:#212121">-Adam <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div id="m_-2918915987570826000ms-outlook-mobile-signature">
<p class="MsoNormal">Get <a href="https://aka.ms/AAb9ysg" target="_blank">Outlook for Android</a><o:p></o:p></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="m_-2918915987570826000divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> ARIN-consult <<a href="mailto:arin-consult-bounces@arin.net" target="_blank">arin-consult-bounces@arin.net</a>> on behalf of Richard Laager <<a href="mailto:rlaager@wiktel.com" target="_blank">rlaager@wiktel.com</a>><br>
<b>Sent:</b> Tuesday, January 24, 2023 2:22:43 PM<br>
<b>To:</b> <a href="mailto:arin-consult@arin.net" target="_blank">arin-consult@arin.net</a> <<a href="mailto:arin-consult@arin.net" target="_blank">arin-consult@arin.net</a>><br>
<b>Subject:</b> Re: [ARIN-consult] [ARIN-Consult] Consultation on Expanding 2FA Options for ARIN Online</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal">On 1/24/23 12:56, Adam Thompson wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>Why on earth would you set a hard-coded limit? It's not like an additional database table is expensive.<o:p></o:p></pre>
</blockquote>
</div>
<div>
<p class="MsoNormal">While, in general, I understand this sentiment (real world cardinality is usually: 1, 2, or many), I do see two counterpoints. Even speaking in general, it is sometimes useful to define a limit for testing purposes. If you say, "We support
5", then you are hopefully actually testing 5.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In this particular situation, I think the following argument is even more relevant:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On 1/24/23 14:02, Tim Lyons via ARIN-consult wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">In terms of allowing the registration of multiple hardware security keys, I suggest allowing a maximum of 3 keys to be registered. This provides backup options in case a user loses or misplaces their primary key but encourages users to
be cognizant of deleting old keys that have been lots or become non-functional.<o:p></o:p></p>
</blockquote>
<pre>-- <o:p></o:p></pre>
<pre>Richard<o:p></o:p></pre>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
ARIN-Consult<br>
You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>
List (<a href="mailto:ARIN-consult@arin.net" target="_blank">ARIN-consult@arin.net</a>).<br>
Unsubscribe or manage your mailing list subscription at:<br>
<a href="https://lists.arin.net/mailman/listinfo/arin-consult" target="_blank">https://lists.arin.net/mailman/listinfo/arin-consult</a> Please contact the ARIN Member Services<br>
Help Desk at <a href="mailto:info@arin.net" target="_blank">info@arin.net</a> if you experience any issues.<o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>